update user model with validation for password