add password hashing