remove pw from user model, mongo now has username