made password caching optional; returning user object on success