module.exports = {
    'new': function(req, res){
        res.locals.flash = _.clone(req.session.flash);
        res.view();
        req.session.flash = {};
    },

    create: function (req, res, next) {
      User.create(req.params.all(), function userCreated(err,user){
          //if(err) return next(err);

          if(err){
            console.log(err);
            req.session.flash = {
              err: err
            }
            //if error redirect back to sign-up page
            return res.redirect('/user/new');
          }

          res.json(user);
        req.session.flash = {};
      });
    }
};

<form action="/user/create" method="POST" class="form-signin">
  <h2 class="form-signin-heading"> Create an account</h2>


  <% if(flash && flash.err){ %>
  <ul class="alert alert-success">
    <% Object.keys(flash.err).forEach(function(error){ %>
    <li><%- JSON.stringify(flash.err[error]) %></li>
    <% })%>
  </ul>
  <%}%>


  <div class="form-group">
  <input type="text" class="form-control" placeholder="your name" name="name">
  </div>

  <input type="text" class="form-control" placeholder="your title" name="title">

  <input type="text" class="form-control" placeholder="email address" name="email">

  <input type="password" class="form-control" placeholder="password" name="password">

  <input type="password" class="form-control" placeholder="password confirmation" name="confirmation">

  <input type="submit" class="btn btn-lg btn-primary btn-block" value="Create Account"/>

  <input type="hidden" name="_csrf" value="<%= _csrf %>"/>

</form>

module.exports = function(req, res, next) {

  res.locals.flash = {};

  if(!req.session.flash) return next();

  res.locals.flash = _.clone(req.session.flash);

  // clear flash
  req.session.flash = {};

  next();
};

   module.exports.policies = {

  /***************************************************************************
  *                                                                          *
  * Default policy for all controllers and actions (`true` allows public     *
  * access)                                                                  *
  *                                                                          *
  ***************************************************************************/

   //'*': true,
   '*': 'flash',
    user:{
        'new': "flash",
        'create': "flash"
    }
  /***************************************************************************
  *                                                                          *
  * Here's an example of mapping some policies to run before a controller    *
  * and its actions                                                          *
  *                                                                          *
  ***************************************************************************/

  巴拉巴拉