added password hashing (with salt!)