temporarily allow old users to log in with MD5 passwords