learned: auth is hard because password hashing is not possible