try to move from plaintext pws to sha1