User.newPassword = function(user, currentUser, done) {
  pass.hash(password, function(err, salt, hash) {
    currentUser.__password = {
      salt: salt,
      hash: hash
    }
    currentUser.updatedAt = new Date();

    User
      .save(currentUser, done);
  });
}