actually adding the has_secure_password for andrew, for reals this time