user passwords are now salted and hashed using bcrypt