everything but password hashing