Password is stored as plaintext for now (prototype). Later we switch to password_hash().