has_secure_password already requires bcrypt