use new concept for has_secure_password issue