implement bcrypt, and change session location