add users model and validations (including secure password)