except password-hash, and applied bcrypt