password is hashed when compared