Local strategy using email address and hashed, bcrypted password