require bcrypt/password