registration stores hash of password and login checks this