They are! they get hashed on User.pre('save')