validationHash & setPassword in auth