Use bcrypt instead of sha-1 for password hashing