password controllers with specs. no views yet.