basic user model. includes secure password