switched from MD5 password hashing to BCRYPT; expect user email verification now