It's only used in login controller: https://github.com/soygul/koan/blob/master/server/controllers/login.js or the new request-2 maybe?