passwords get hashed when user created