auth hashing --- not tested