update user model to include passwords