add /users/:id route, abstract apiKey check
add bcrypt dependency
code cleanup