use passlib bcrypt for passwords, random salts