now with pbkdf2 instead of sha