passwords hashed with the recommended SSHA rather than MD5