basic user model with secure passwd