authentication with password hash and salt