add password encryption
password is md5 hashed in database, from controller.js