password was being hashed twice