modified cross site auth to use a hash