GBE-448: encode passwords; remove oldPassword field in UpdateUser