pre-hash password