switch to password_verify and password_hash