store passwords as salted hash