fixed password fields in user schema/migration