Do not double-hash user passwords #378