implement account settings + actually hash passwords instead of storing them plaintext