User authentication works, uses bcrypt for password validation