extract user_auth service from sessions helper

refactor user model to use "has_secure_password"