use scrypt to store and verify passwords