salt and raw password are quite shy...