since this is advanced app, would be great if you will exclude `password_hash` from mass assignment here, like in this [guide](https://github.com/yiisoft/yii2/blob/master/docs/guide/model.md). If some other fields will be added (`created_at, updated_at, created_by, updated_by`) they also should be excluded.