salt shouldn't be necessary with BCrypt.

encrypted_password and remember_token can be `null: false`.