use update_attributes!
extract AuthHash class out of User