added bcrypt to package, corrected auth