update passwords without hash to hashed version

- use auth_users
- hashing only passwords which are not already hashed