*update* user auth against mongodb with password encoder