add association and has_secure_password to user class