no reason to remove hashed password