updated controller. still uses jquery ajax
added md5 to client password