move get-player into the rootCtrl instead of the run function
hash password with bcrypt