Note that several times, user.Password was set to a plain text password, but then later changed to a hashed password, creating data inconsistency. This also changes User.Password to private set to prevent further accidents.