password should not undergo md5