Encapsulate the fact that passwords are saved as hashes in user model.

[Askir]

Currently the user model has a property password and every line that saves a new password has to manually hash it. The method update somewhat encapsulates this already.

A nice way to do this imo, would be to rename the property to _password_digest (making in private) and adding accessors with @property and @setter to password which encapsulate the hashing.
This way a new password can be saved like this:

if user.check_password(old_password):
  user.password = new_password

and it will still be hashed.
user.update(password=new_password) will also work without overriding the update method then.