everything works so far
use has_secure_password
session works
transfer works