cache passwords so we don't do bcrypt all the time