bcrypt never really was a dependency