sf storing passwords as sha1 hashes