Add password mechanism to User model, with all validations, and extensive test coverage