fixed password hash bug