don't save password as plain text. instead generate salt and hash password.