add validations to user.rb