add comments to clarify handling of salt and hash