string -> bcrypthash
initial password confirmation - validate in database rather than in ruby (why?)