uses sha1 for hashing, default salt length = 16