Use a real database.

Password needs to be a string so password hash
comparison doesn't fail because he db adapter returns bytes.