add user password specs and has_secure_password