add a proper user model with passwords & test cases