updated password hashing