functions. Cleaned up user class to prevent marshalling of passwords,
but handle incoming password values properly. Separated create and
update methods. Made error reporting more robust.