Use bcrypt to store passwords instead of SHA-2