move valid_password? to core model