8b2f93516d
currently this is flagged manually in one place, but there's no reason not to let the user model handle it. this way, you can update your user model from a console or some other area without accidentally changing your password.