passwords are now hashed