finish User model, add passwords