password hash only if provided