change from bcrypt to SHA2