fix bug in password hasher