add PasswordVerifier to replace simple hashing. fixes #1