md5'd the password before it gets saved