moved hashing user's password from controller to model