add test for random string
use sha256 for user passwords