arbitrary fields in user.custom
validate user data
safer access-rule application
login both via password and hash
get and modify current user
cleanup