use bcrypt for passwords, closes #108
version bumped 0.9.11