added users resource to routes, added password to user model