security fix. add bcrypt