store hashcodes of passwords not plain text