password fields removed from user model