user password hashing bugfix