working on sessions and BCrypt