Settings page, admin vs os login (serverside), password hashing