changed to encrypt password client side