* use sha1 for the web auth