The password received for the LOGIN route should be in clear (not hashed) Once received, it should be hashed and compared with the one used in the DB