added note about bcrypt, closes #142