Much of the text on Habitica's website either has no alt text or is not allowing screen readers to read the alt text. This is a serious accessibility issue as it means that anything that is represented solely by a graphic is essentially invisible to blind users of the site.

In some cases there is no alt text, but there is a tooltip. However, the screenreader will not read out the text unless y

It would be better to use bcrypt, beause its more secure as it's slower (uses more computing cycles).
Your code could also be better:

You wouldn't need salt field in User model, because it's saved into the same field as password does.

For authentication, something like:

var mongoose = require('mongoose'),
  bcrypt = require('bcryptjs');

var userSchema = mongoose.Schema({
  email: String,