add valid password method to user model