removed bcrypt and top-level userschema.js