Switched from MD5 to SHA-256 for password hashing