This method does not belong on user.  A user does not manage login credential, but a `UserAuthenticator` class might well bear this method.