changed comment about how password hashes should be generated