use *_hex instead of encrypt/decrypt. otherwise the passwords aren't stored in DB