hmm, it's not decrypting the password out of the hash