Use SHA2 for expected authorization hash.