Ok, user create available at /user/register, password now set using bcrypt, and login switched to use bcrypt so now we are all secure and all that