add user model and use has_secure_password