login works now (hashing included)