code: function (connection, attempt) {
    var clonedAttempt = EJSON.clone(attempt);
    clonedAttempt.connection = connection;
    return clonedAttempt;
  }
docs: Give each login hook callback a fresh cloned copy of the attempt object, but don't clone the connection.