user model is setup w/ passwords