Currently an active session is required to access entries, but does not limit to a specific user.

I need to decide on how I want to handle sessions between client and API.

Cookie based authentication seems sufficient. I'll go with that. Session hash = secret + user id + creation time.

Your User model is fine for a very simple case but in the real-world people will need to be able to change their passwords.

Given you can't access model methods from within the beforeCreate and beforeSave methods, and with a view to maintaining DRYness as much as possible, what changes would you make to your User model such that when a user's password is updated it's properly hashed. Obviously just changing beforeCreate to beforeSave is not going to work as then the password will be rehashed every time it's saved.

There are a number of ways to do this but I'm wondering what the best-practice, DRY way would be.