user model tested, buth no passwords