Forbes Lindesay

@ianstormtaylor Yes, it fixes the bug, but that change needs to be made to every synchronous engine's implementation, and there are other closely related bugs with many of the synchronous...

How is the proposed solution wrong? Ideally you would use a system like promises to support error propagation, but not doing so doesn't seem "wrong", just not ideal.

I think we should probably wrap this up so it supports [component](https://github.com/component/component/) instead? We could then use that to provide a standalone build with the global `ejs`. I know the...

I'll add that in when I do layouts/partials if you want?

Don't inline a polyfill for JSON, either make do without `JSON.stringify`, or require it. We probably have other things that break worse in older browsers anyway, just get people to...

Yes, older browsrs will need to polyfill JSON. The problem is that they will most likely need JSON for things other than EJS. This change would force even modern browsers...

At the moment this only supports synchronous strategies. The reason for this is that I wanted to support things like: ``` javascript app.get('/home', function (req, res, next) { if (req.user.is('admin'))...

Yes, I should've commented on that, because `this` inside the authenticationStrategies refers to the `request` object, you can load anything you need in advance and put it in the `request`...

The next version will also support an alternative option whereby all authorisation strategies are allowed to return Promises rather than true/false. This lets them be async, but also means that...

@mvolkmann Yes, if someone adds a test case to cover it.