installation security bug - using saltedhash instead of deviceid now