Password wasn't hashed before saving it in the database

if the user changed the password in the browser.

Fixes #17