make a better User model incl secure passwords