added password to user model on clientside to send w/ default ajax... should absolutely change this?