add password authentication and password hash