refactor and remove the explicit update method on user and tenant; hide create and update as private methods;