hash password on auth