User passwords should be hashed rather than encrpyted/decrypted

[joshdentremont]

Instead of using the encrypt and decrypt functions the password should be hashed using password_hash and then checked for a match, using password_verify