mention has_secure_password in README.