hash the saved password
use only _id no need for the 'name' key in the db