model: emulate user.password hashing
model: implement user.authenticate