update password hash