change password hashing algo to sha256