add password to User (and validation)