user model with secure pw and multi attribute auth