Waterline lifecycle callback on FindOne?

Waterline supports lifecycle callbacks (docs). My User model has:

beforeValidate: hash_password,
beforeCreate: hash_password,
beforeUpdate: hash_password

Which works fine for creating/updating records (I double checked in the database).

However on my findOne I always get a NotFoundError:

User.findOne({email: req.body.email, password: req.body.password}, (err, user) =>
                 cb(err ? err : !user ? new NotFoundError('User') : null)

Turning on database logging, I confirmed that the password in the findOne is never hashed.

What am I doing wrong?

via A T