diff --git a/accounts.js b/accounts.js
index 699a16e..f38660d 100644
--- a/accounts.js
+++ b/accounts.js
@@ -71,7 +71,6 @@ function getOrCreate(store, iss, username) {
 
     // TODO profile should be ecdsa256 pub/privkeypair
     var sub = makeB64UrlSafe(crypto.randomBytes(32).toString('base64'));
-    var iss = req.experienceId;
     profile = {
       id: sub + (iss && ('@' + iss) || '')
     , username:  username
@@ -175,6 +174,15 @@ function createOtp(store, params) {
     });
   });
 }
+function rejectDeleted(el) {
+  if (el && (!el.revokedAt && !el.deletedAt)) {
+    return el;
+  }
+  return null;
+}
+function filterRejectable(arr) {
+  return arr.filter(rejectDeleted);
+}
 
 function create(deps, app) {
   var restful = {};
@@ -435,15 +443,6 @@ function create(deps, app) {
     });
   };
 
-  function rejectDeleted(el) {
-    if (el && (!el.revokedAt && !el.deletedAt)) {
-      return el;
-    }
-    return null;
-  }
-  function filterRejectable(arr) {
-    return arr.filter(rejectDeleted);
-  }
 
   var Credentials = {};
   Credentials.getOrCreate = function (credential) {