Fixes: password hashing, salt