password-hash added as a dependency