This week's book giveaway is in the OCAJP 8 forum. We're giving away four copies of OCA Java SE 8 Programmer I Study Guide and have Edward Finegan & Robert Liguori on-line! See this thread for details.
Wouldn't that be user.getPassword(). At least that is the way it should be. If it doesn't work, then there is something wrong with how you are using the form tags and setting the model attribute. But I don't quite see anything wrong there.
But the way it is all supposed to work, you just call user.getPassword()