update user model; secure password