@wip don't define password attributes because they clobber database_authenticatable's password attributes and the two strategies can't be used together