password bcrypt + finished auth route