working user model, though pw fields dont have type of password
fixed pw field to set type to pw to mask input