UserModel:
  changed user and pass by username and password.
  added "active" field to add an activation step before give full functionality.
  removed passRecoverHash field
  removed genHashPassResetByEmail() and resetPassByHash(). this kind of task been delegated to the UI client. This API only must know how to manage users and not apply business logic.

User API:
  get: standardized status codes
  post: now returns the created user.
  put:
    better field checking before update an user.
    now update can be performed using username or email (unique keys in the schema). credentials now are delegated to de API caller (with role appcomponent for example.)

removed "/user/retrieve-password" and '/user/pass/reset-by-hash'. see UserModel comments to know why.