usermodel, pw salting + hashing and sessions