have a working user model with secure passwords and all tests