properly create $salt before crypting password