user signup post API, part 1: hash the password and store in the db