model: add user.hash for bcrypt password