public async Task <User> Authenticate(string username, string password)
        {
            var dbUser       = MongoService.GetUser(username).Result;
            var authenticate = await Task.Run(() => dbUser.Password.Decrypt() == password);

            // return null if user not found
            if (!authenticate)
            {
                return(null);
            }

            // authentication successful so return user details without password
            dbUser.Password = null;
            return(dbUser);
        }