move password hashing to separate table