using two password hashes