add a User model using has_secure_password