keep password and salt out of user instance cache, fix cache::keygen