Store the password hash instead of password in login.secret, it's a bit more secure