changed sequence in hash_pass

Reason is - it makes possible to make pages where logged in users can add users to the system, not only a free for all registration page but a closed system. Shouldn't break anything AFAIS tmp_data is set rarely and hash_pass can't break it, take a look though.