removed password-creation logic from User class