change auth example to hash passwords, fix #606