Passwords: added needsRehash()