Moved sensitive info out of User model.

Since the UI needs to query for users, move sensitive information
away from the user model into separate UserEmail (where a user can
have more than one email address associated with their account and
can set a primary email address) and
UserPassword (for storing hash'd passwords)