remove rabl, use active record serializer
use bcrypt for user auth