hash password before saved to database