model: implement user.password hashing