hash password, then hash hashed password + salt