UserFilter / UserService: Allow filtering on password hash