authentication with hashing works