using BCrypt to protect the password