add a todo + store security questions (do not use that) hashed

Signed-off-by: Mattias Andrée <maandree@operamail.com>