add password and session token helper methods to user model