added password-hash in package.json