use bcrypt for password hashes

bcrypt is a modern password hashing function, providing better protection against offline attacks than the currently used plain md5.