moved the password generation to bcrypt