commented password in user model