hash password before save()