moved sha1 to clientside