use bcryptjs instead of password-hash
configure passport