added nullable to users.password field