use app instead of process.env
encrypt password only in production