added bcrypt hashing of password so that db doesn't contain plaintext