moved password functions to schema.methods