actually adding the has_secure_password for andrew, for reals this time

It feels like a lot of these tests are testing that ActiveRecord generates getters and setters. I don't think that needs to be tested.