PHP: issues managing the password, what is wrong?