add bcrypt dependency
basic user model
require longer-than-4-chars passwords
better testing