Staff model now explicity restricts password object
The compare passport function does a hard lookup against Mongo to obtain the hash
Bcrypt has been moved into password.set instead of a presave handler