Decouple the User storage model from the external API; allow changing the password
Removing old server code