@user should respond to password digest