Database statements in new account handler may need transaction

[aantron]

There is a select followed by an insert. Since promises are used (and maybe the underlying APIs are asynchronous as well), it is possible (though unlikely) that two requests will complete the select before either completes the insert. In that case, two links will be sent, but only one will be valid.

[fxfactorial]

Nice catch! Yes, I think it should be done with a transaction.

[khajvahmac]

You can make the email field unique and catch errors after insert statement. Not sure how transactions can help here.