$password & $hash mixup
making updating user possible if password has changed