migrate encrypted pwd + salt