refactor test specs
add User model and password attribute