Password check moved to User_Model

For security the password of the user is removed from the controller. sadly the password variable can't be made private or protected. i'm not sure why.