staff password hashing fixed