code: function preSave(next) {
    // jshint validthis: true
    var self = this;
  
    if (this.isNew && !validatePresenceOf(this.hashedPassword)) {
      return next(new MongooseError.ValidationError('Missing password'));
    }
  
    // check if the root user should be updated
    // return an error if some not root tries to touch the root document
    self.constructor.getRoot(function (err, rootUser) {
      if (err) {
        throw err;
      }
  
      // will we update the root user?
      if (rootUser && self.id === rootUser.id) {
  
        // delete the role to prevent loosing the root status
        delete self.role;
  
        // get the user role to check if a root user will perform the update
        var userRole = contextService.getContext('request:acl.user.role');
        if (!userRole) { // no user role - no root user check
          return next();
        }
  
        if (!auth.roles.isRoot(userRole)) {
          // return error, only root can update root
          return next(new MongooseError.ValidationError('Forbidden root update request'));
        }
      }
  
      // normal user update
      return next();
    });
  }
docs: Pre save hook for the User model. Validates the existence of the
  hashedPassword property if the document is saved for the first time.
  Ensure that only the root user can update itself.
  
  @api private
  @param {Function} next - The mongoose middleware callback
  @returns {*} If an error occurs the passed callback with an Error as its argument is called