Tip: set real password hashes in the DB using password_hash.