Removed password field from user object, updated user repos to be a little more obvious in how/where you're supposed to hash password before storage