fix issue #1: Use salt + hash for passwords