use salt for auth