authenticate w/ hash, salt against database!