Adds a unique validation plugin for mongoose that seems to be doing the trick. And writes a failing test to ensure that passwords are getting hashed.