Change hash_exists() to a private function.
Add a call to hash_exists() in set_password().