add user authentication with has_passwords