fixed BCrypt authentication