add User model and has_secure_password