use hmac instead of hash for passwords closes #7