save passwords as hashes
add error messages