md5 hashing done server side instead