using MessageDigest to check hashed passwords