user login and password hashing works