more work: proper password hashing; added more routes; fake data