password hashes should be exact match (===)
support plaintext passwords as final fallback