Wouldn't that be user.getPassword(). At least that is the way it should be. If it doesn't work, then there is something wrong with how you are using the form tags and setting the model attribute. But I don't quite see anything wrong there.
But the way it is all supposed to work, you just call user.getPassword()