add user controller and basic user model (name, email, password) - insecure password, and controller only does #new