Fix credentials/challenges types

Associated identities and credentials are now captured by models in
loopback-component-passport. These two properties will be removed in
2.x.

lib/models/user.js

@@ -26,22 +26,11 @@ var properties = {
     realm: {type: String},
     username: {type: String},
     password: {type: String, required: true},
+    credentials: Object, // deprecated, to be removed in 2.x
+    challenges: Object, // deprecated, to be removed in 2.x
     email: {type: String, required: true},
     emailVerified: Boolean,
     verificationToken: String,
-
-    credentials: [
-        'UserCredential' // User credentials, private or public, such as private/public keys, Kerberos tickets, oAuth tokens, facebook, google, github ids
-    ],
-    challenges: [
-        'Challenge' // Security questions/answers
-    ],
-    // https://en.wikipedia.org/wiki/Multi-factor_authentication
-    /*
-    factors: [
-        'AuthenticationFactor'
-    ],
-    */
     status: String,
     created: Date,
     lastUpdated: Date