relocate bcrypt hashing to user model