bump mash dependency
validate tests
some more user tests
webp is now an option
bump simgr
move bcrypt work factor settings into variables
remove app settings