extract user_auth service from user/session helper

refactor user model to use "has_secure_password"