Use Mongoose for User, remove local authentication