moved bcrypt methods out of User schema so that they can be asynchronous