updated user model to include password