upgraded passwords without hash to hashed version

We remove the password on read, maybe the best way would be to call find_all(auth_users) as this will return the password.