rudimentary authentication with passport and bcrypt