added has_secure_password to user.rb