This week's book giveaway is in the OCPJP forum. We're giving away four copies of OCA/OCP Java SE 7 Programmer I & II Study Guide and have Kathy Sierra & Bert Bates on-line! See this thread for details.
Wouldn't that be user.getPassword(). At least that is the way it should be. If it doesn't work, then there is something wrong with how you are using the form tags and setting the model attribute. But I don't quite see anything wrong there.
But the way it is all supposed to work, you just call user.getPassword()