can we avoid this by just using java built in MD5? I'm trying to get apache commons out of the deps (Ashu saw a problem with it in the past and we are only using it for trivial stuff).