check user by hash