updated api readme
/login use hashed password to compare with db