update to use bcrypt for passwords