Login checks hash instead of pw