user session and BCrypt working