add bcrypt, implement has_secure_password