password hash is now salted