add SHA-256 support

We use this internally for our API, as sha-1 isn't as secure these days.