If `public` this method should call `hashPassword()` : client shouldn't be left with the responsibility to hash every password.