moved password salt from controller to model