store password (hash / salt) against user.