security fix: don't save password as plain text (instead generate salt and hash password)