tests around password hashing