I realize it's a bit strange to have auth related methods at the `User` model level, as only one instance should be concerned, the one of the currently authenticated user (the browser user).

atm, I don't have a clear sense how to circumvent that though.