user can sign up, and their passwords are stored with bcrypt