[Serusers] how not to store clear text passwd in database