hash+salt password with pbkdf2