User model now using mongoengine
moved auth services into it's own module auth.py