password hashing instead of raw passwords