updated to use bcript and added User.generatePassword and User.verifyPassword functions