use hashed password for db auth