split up UserManager into public & private (ORM dependent) interface