finish user model, added secure pw