let bcrypt generate salt instead of providing a static salt by config