set password hash on creating user