fix login hashing and password validation.