screwed up password model. now it's fixed