user.password is not use anywhere else than validate_password method and only used by validate_identity().
I don't mind changing the name though.