use passwordHash in SecurityEjb