UserManager - only code, not tested