implement bcrypt for passwords (npm/provision)