basic user model, including secure password logic