使用nodejs+mongoose更新用户账号时报_id主键拒绝

exports.updateAccount = function(req, res, next) {
var proxy = new EventProxy();

var render = function(data) {
    res.send(data);
};

proxy.assign('updateAccount', render);

var where = {};

var userId = req.param('userid')
    , account = req.param('account')
    , password = req.param('password2')
    , username = req.param('username');

where = {'_id': userId, 'password': password};
Account.findOne(where, function(err, account) {
    if (err)
        return next(err);

    var result;
    if (account != null) {

        account.account = account;
        account.password = password;
        account.username = username;
        console.log(account+'dd');
        account.update(function(err) {
            if (err)
                return next(err);
        });
        result = {'success': true};
    } else {
        result = {'success': false};
    }
    proxy.trigger('updateAccount', result);
});

}