add bcrypt to package; extract server config