diff --git a/scopes/api/auth/user.py b/scopes/api/auth/user.py
index 7e03839..0d22e86 100644
--- a/scopes/api/auth/user.py
+++ b/scopes/api/auth/user.py
@@ -12,17 +12,19 @@ from scopes.config import settings
 from scopes.storage import user as st_user
 from scopes.storage.common import Storage
 
-class User(BaseModel):
-    uid: str | None = None
-    timeStamp: datetime | None = None
+class UserBase(BaseModel):
     name: str
     login: str
     display_name: str
     email: str | None = None
-    pw_hash: str | None = Field(exclude=True, default=None)
     groups: List[str] = Field(default_factory=list)
 
-class UserIn(User):
+class User(UserBase):
+    uid: str | None = None
+    timeStamp: datetime | None = None
+    pw_hash: str | None = Field(exclude=True, default=None)
+
+class UserIn(UserBase):
     password: str | None = None
 
     def hashPassword(self) -> str | None:
diff --git a/scopes/storage/tracking.py b/scopes/storage/tracking.py
index 6bc7132..82dd70e 100644
--- a/scopes/storage/tracking.py
+++ b/scopes/storage/tracking.py
@@ -120,13 +120,15 @@ class Container:
         changed = False
         if found.data != track.data:
             found.update(track.data)
+            track.data = found.data
             changed = True
         if track.timeStamp is not None and found.timeStamp != track.timeStamp:
             found.timeStamp = track.timeStamp
             changed = True
         if changed:
-            self.update(found)
+            self.update(found, not track.timeStamp)
         track.trackId = found.trackId
+        track.timeStamp = found.timeStamp
         return found.trackId
 
     def insert(self, track, withTrackId=False):
diff --git a/scopes/storage/user.py b/scopes/storage/user.py
index f0c655e..3e329c4 100644
--- a/scopes/storage/user.py
+++ b/scopes/storage/user.py
@@ -12,7 +12,8 @@ class User(concept.Concept):
     def prepareData(data, obj):
         data = concept.Concept.prepareData(data, obj)
         pw = data.pop('password', None)
-        data['pw_hash'] = obj.hashPassword()
+        if pw:
+            data['pw_hash'] = obj.hashPassword()
         return data