needs bcrypt