updated login.js to hash passwords