basic model for user including security