switch to bcrypt