nodemailer is introduced. unfortunately, can not email user the forgotten password. bcrypt is one way hash with salt.
/register is added, by email