close #46, now we use sha1+salt to store the users' password