move user db interaction from auth.js to user-ctrl.js. remaining is move user mongoose object out of auth.js too