user: move password correct function from auth to being on the user object itself