moved some logic out of UserDao that should really be in the service