Update README
use bcrypt for passwords