password hashing and login tweaks