basic user model including secure password