feature: use bcrypt for hashing passwords