XNAT-2840 Fallout from user creation, listing, and invalidation

functions. Cleaned up user class to prevent marshalling of passwords,
but handle incoming password values properly. Separated create and
update methods. Made error reporting more robust.