write spec for user password
fix has_secure_password