include secure password in user model