[galaxy-dev] best practice to replace the hashing for galaxy-user passwords