encrypt password with HMAC when login