hash user password at the browser side