password should be accessed as key in hash