make basic user model, including secure pw