login uses salted hash