more pw hashing fixes