fix password hash logic