user passwords are hashed for storage