Fix up user to only be email/password, add optimistic locking