diff --git a/common/models/User-Identity.js b/common/models/User-Identity.js
index 588a3be3de..720e98b44a 100644
--- a/common/models/User-Identity.js
+++ b/common/models/User-Identity.js
@@ -3,6 +3,11 @@ var debug = require('debug')('freecc:models:userIdent');
 var defaultProfileImage =
   require('../utils/constantStrings.json').defaultProfileImage;
 
+function getFirstImageFromProfile(profile) {
+  return profile && profile.photos && profile.photos[0] ?
+    profile.photos[0].value :
+    null;
+}
 module.exports = function(UserIdent) {
  UserIdent.observe('before save', function(ctx, next) {
   var userIdent = ctx.currentInstance || ctx.instance;
@@ -17,23 +22,27 @@ module.exports = function(UserIdent) {
       return next();
     }
 
-    var picture = userIdent.profile && userIdent.profile[0] ?
-      userIdent.profile[0].value :
-      null;
+    var picture = getFirstImageFromProfile(userIdent.profile);
 
-    // check if user has picture
-    //  set user.picture from twitter
-    if (picture && !user.picture || user.picture === defaultProfileImage) {
-      debug('use has no pic');
+    debug('picture', picture, user.picture);
+    // check if picture was found
+    // check if user has no picture
+    // check if user has default picture
+    // set user.picture from oauth provider
+    if (
+      picture &&
+      (!user.picture || user.picture === defaultProfileImage)
+    ) {
+      debug('setting user picture');
       user.picture = userIdent.profile.photos[0].value;
-      user.save(function(err) {
+      return user.save(function(err) {
         if (err) { return next(err); }
         next();
       });
-    } else {
-      debug('exiting after user ident');
-      next();
     }
+
+    debug('exiting after user ident');
+    next();
   });
  });
 };
diff --git a/common/models/user.js b/common/models/user.js
index af104e8e39..0806d97e0b 100644
--- a/common/models/user.js
+++ b/common/models/user.js
@@ -8,6 +8,8 @@ module.exports = function(User) {
   // see:
   // https://github.com/strongloop/loopback/issues/1137#issuecomment-109200135
   delete User.validations.email;
+  // set salt factor for passwords
+  User.settings.saltWorkFactor = 5;
   debug('setting up user hooks');
   // send verification email to new camper
   User.afterRemote('create', function(ctx, user, next) {
diff --git a/common/models/user.json b/common/models/user.json
index 7aeca01d1e..8e15a241dc 100644
--- a/common/models/user.json
+++ b/common/models/user.json
@@ -242,5 +242,5 @@
       "property": "doesExist"
     }
   ],
-  "methods": ["login"]
+  "methods": []
 }
diff --git a/server/boot/a-extendUser.js b/server/boot/a-extendUser.js
index 951705c650..ff4b08ed2c 100644
--- a/server/boot/a-extendUser.js
+++ b/server/boot/a-extendUser.js
@@ -1,32 +1,36 @@
 var Rx = require('rx');
 var debug = require('debug')('freecc:user:remote');
 
-function destroyById(id, Model) {
-  return Rx.Observable.create(function(observer) {
-    Model.destroyById(id, function(err) {
-      if (err) { return observer.onError(err); }
-      observer.onCompleted();
-    });
-    return Rx.Disposable(Rx.helpers.noop);
-  });
+function destroyAllRelated(id, Model) {
+  return Rx.Observable.fromNodeCallback(
+    Model.destroyAll,
+    Model
+  )({ userId: id });
 }
 
 module.exports = function(app) {
   var User = app.models.User;
   var UserIdentity = app.models.UserIdentity;
   var UserCredential = app.models.UserCredential;
-  User.observe('after delete', function(ctx, next) {
+  User.observe('before delete', function(ctx, next) {
     debug('removing user', ctx.where);
     var id = ctx.where && ctx.where.id ? ctx.where.id : null;
     if (!id) {
       return next();
     }
     Rx.Observable.combineLatest(
-      destroyById(id, UserIdentity),
-      destroyById(id, UserCredential),
-      Rx.helpers.noop
+      destroyAllRelated(id, UserIdentity),
+      destroyAllRelated(id, UserCredential),
+      function(identData, credData) {
+        return {
+          identData: identData,
+          credData: credData
+        };
+      }
     ).subscribe(
-      Rx.helpers.noop,
+      function(data) {
+        debug('deleted', data);
+      },
       function(err) {
         debug('error deleting user %s stuff', id, err);
         next(err);