need to put back salt and encrypted pw if user is not updating pw