add password_required? in users