refactor password hashing