fixed password hashing