implement SHA-1 password hashing and fix some bugs in User.create()