almost all user functions should be performed through Person. only password stuff should be User-related
removing older, backup file version