before_create

updating user does not encrypt password but would conflict with
updating password feature in the future. log in on sign up works again
but the fix may not be secure. profile picture no longer shows if nil