user password with hash in the DB