add sane password validator that can accommodate hashed passwords