public User Login(string Email, string Pass)
        {
            var user = db.Users.Include(r => r.Role).FirstOrDefault(e => e.EmailAddress == Email);

            if (user == null)
                throw new Exception("User not found");

            if (Hashing.ValidatePassword(Pass, user.Password))
                return user;

            // if we got here, something went wrong, throw an exception
            throw new Exception("Invalid email address or password.");
        }