wp_hash also sanitized