add lots of tests for user model and password authentication