check bcrypt pass with and without pepper