Move password handling to User struct
Remove request from environment
Remove global repo - inject where needed