auth: support unhashed passwords