     User.deriveHashAsync password, self.username
       .then (hash) ->
         if self.hash == hash
-          User.deriveHashAsync newPassword, self.username
+          self._setPassword newPassword, cb
         else
           throw new Error("User.changePassword:incorrectPassword")
-      .then (hash) ->
-        self.hash = hash
-        cb null
       .catch cb
   serializeKey: (cb) ->
     Crypto.hash User.hashType, 'user:' + @username, cb

  @encType: 'aes256'
  @hashType: 'sha256'
  @deriveKey: (username, password, cb) ->
    console.log 'User.deriveKey', username, password
    Crypto.createKey @encType, @prefix + username + password, username, (err, buffer) ->
      console.log 'User.deriveKey', username, password, err, buffer
      if err
        cb err
      else

    for key, val of options
      @[key] = val
  initPassword: (password, cb) ->
    if @hasOwnProperty('hash')
      return cb new Error("User.initPassword:alreadyInited")
    @_setPassword password, cb
  _setPassword: (password, cb) ->
    self = @
    User.deriveHashAsync password, self.username
      .then (hash) ->
        self.hash = hash
        cb null
      .catch cb
  changePassword: (password, newPassword, confirm, cb) ->
