added db.py -- only holds email / password so far
_id in user model