adds password validation via has_secure_password