password now hashed with bcrypt