authentication uses bcrypt now (falls back to sha1 if bcrypt password doesn't exist - saves bcrypt after sha1 authentication and uses it from then on out). Fixes with use of 'require' that was causing double validations and multiple assignment of constant messages. Other cleanup