cleaned up user model, allow blank passwords on update; minor tidy work