support password hash, minor review