added algorithm to password_hash

also, just remembered, public code means no good passwords.

all hardcoded users will either have 'password' or some variation to
prevent theft.