moved password outside of devise module