apiKeys() {
        return this.hasMany('ApiKey', 'user_id');
    }
CASE: add model, hash password
CASE: update model, hash password

Important:
  - Password hashing happens when we import a database
  - we do some pre-validation checks, because onValidate is called AFTER onSaving
  - when importing, we set the password to a random uid and don't validate, just hash it and lock the user
  - when importing with `importPersistUser` we check if the password is a bcrypt hash already and fall back to
    normal behavior if not (set random password, lock user, and hash password)
  - no validations should run, when importing