password model updates. incomplete