finish basic user model with passswords