improve user model class

- don't update updated_at when updating last_login
- extract some behaviour from event listeners into model methods