password now encrypts and is auth'able