hash for authorized user