test password_hash bypass