Moved all password hashing to client side