diff --git a/lib/server/setupStore.js b/lib/server/setupStore.js
index d27f930257..199e6a81fc 100644
--- a/lib/server/setupStore.js
+++ b/lib/server/setupStore.js
@@ -8,15 +8,38 @@ module.exports.queries = function(store) {
 
 module.exports.accessControl = function(store) {
   store.accessControl = true;
-  store.readPathAccess('users.*', function(captures, next) {
-    var allowed;
-    allowed = captures === this.session.userId;
-    return next(allowed);
+  store.readPathAccess('users.*', function() {
+    var captures, next;
+    if (!(this.session && this.session.userId)) {
+      return;
+    }
+    captures = arguments[0];
+    next = arguments[arguments.length - 1];
+    console.log({
+      readPathAccess: {
+        captures: captures,
+        sessionUserId: this.session.userId,
+        next: next
+      }
+    });
+    return next(captures === this.session.userId);
   });
-  return store.writeAccess('*', 'users.*', function(captures, value, next) {
-    var allowed, pathArray;
+  return store.writeAccess('*', 'users.*', function() {
+    var captures, next, pathArray;
+    if (!(this.session && this.session.userId)) {
+      return;
+    }
+    captures = arguments[0];
+    next = arguments[arguments.length - 1];
     pathArray = captures.split('.');
-    allowed = pathArray[0] === this.session.userId;
-    return next(allowed);
+    console.log({
+      writeAccess: {
+        captures: captures,
+        next: next,
+        pathArray: pathArray,
+        "arguments": arguments
+      }
+    });
+    return next(pathArray[0] === this.session.userId);
   });
 };
diff --git a/src/server/setupStore.coffee b/src/server/setupStore.coffee
index 003a9ef4d6..2272f745d5 100644
--- a/src/server/setupStore.coffee
+++ b/src/server/setupStore.coffee
@@ -3,16 +3,22 @@ module.exports.queries = (store) ->
     @byId(id)
     
 module.exports.accessControl = (store) ->
-  
   store.accessControl = true
   
-  store.readPathAccess 'users.*', (captures, next) ->
-    allowed = (captures == @session.userId)
-    # console.log { readPathAccess: {captures:captures, sessionUserId:@session.userId, allowed:allowed, next:next} }
-    next(allowed)
+  # FIXME callback signatures here have variable length, eg `callback(captures..., next)` 
+  # Is using arguments[n] the correct way to handle this?  
+
+  store.readPathAccess 'users.*', () -> #captures, next) ->
+    return unless @session && @session.userId # https://github.com/codeparty/racer/issues/37
+    captures = arguments[0]
+    next = arguments[arguments.length-1]
+    console.log { readPathAccess: {captures:captures, sessionUserId:@session.userId, next:next} }
+    next(captures == @session.userId)
     
-  store.writeAccess '*', 'users.*', (captures, value, next) ->
+  store.writeAccess '*', 'users.*', () -> #captures, value, next) ->
+    return unless @session && @session.userId
+    captures = arguments[0]
+    next = arguments[arguments.length-1]
     pathArray = captures.split('.')
-    allowed = (pathArray[0] == @session.userId)
-    # console.log { writeAccess: {captures:captures, value:value, next:next, pathArray:pathArray} }
-    next(allowed)
+    console.log { writeAccess: {captures:captures, next:next, pathArray:pathArray, arguments:arguments} }
+    next(pathArray[0] == @session.userId)
\ No newline at end of file