model: add user.password and confirmation