move password hash to attrib