add User model and tests
add secure passwords to User model