add User model and secure passwords