user validations
make a User model (including secure passwords)