switched to passing md5 of password to php (except initial auth)