add User model with secure passwords