encrypting passwords at client end instead of server end