make a user model with secure passwords
finish user signup
add SSL in production
finish signin/out