hash user password on update