wrapped bcrypt compare to handle null and empty string.  enabled login endpoint