make user model with secure pw