added TODO to upgrade from SHA password encryption #1034