fix bracketing, hash password when updating