User.js cleanup: spec, jshint satisfaction

I have added simple spec for User - nothing special here.
But jshint cleanup was rather intriguing and I would like to highlight/confirm few things:
1. crypto was required, but never used - so it went away
2. winston was used in one of the errors report, but not defined. fixed.
3. IF's brackets were fixed all around the file
4. I don't get the reason behind `function(param = 'value')` - it just creates global. reworked it into `var param='value', function(param)`; on line 390 just removed `query` - please confirm that there is no special magic was coming from it :)
5. There are few bitwise operations with `|` - I kept them 'as is' - even during the daylight I don't get close to those creatures, not to mention 2am :) Can you add it as a bad style in coding guide, please? It just takes too much effort to figure them out every time :'(