access to user.password attribute changed, views and tests refactored