persist passwordHash instead of readable password