bugfix password authentication (must supply hash)