hash user password, don't return hashed password

uses bcrypt-nodejs