store user's password as MD5 hash