I was browsing your source and saw you didn't know why async version wasn't working
compare your code with this module
https://github.com/tblobaum/mongoose-troop/blob/master/lib/basicAuth.js
you'll see you need to call it on the .pre('save') event, and not try to set a field value sync.