fixes a related double-hashing-password bug, #324