Fixed bug in login handler

Now referencing user.password instead of user.hashed.