user model with secure authentication
finish user signup
SSL in production
extra tests for flashes