add password-hash package
frontend session check