password hashing and duplicate user protection