basic user model with secure authentication