registration: fixed redirect url and password hash