fixed password generation (was hashing twice)