Use hashPassword on user update / create, not just on login.