UserCollection: make password-hashing monkey-patch-able