added password_needs_rehash() check