user model with validations but no password
add secure password