refactor signup behavior
use bcrypt to hash passwords