Use bcrypt instead of sha1

This pull request removes sha1 to encrypt and compare password and replaces it with [bcrypt](https://npmjs.org/package/bcrypt). The bcrypt library was intended for pasword encryption and includes a built in salt as well as a built in compare function. There is no need to use an application secret to encrypt passwords.

I also fixed a missing dependency in the package.json file.