put the password hash in place