since comments are purged into outdated diff now -- I am still not sure if "hash is not" worth banning on because occurs "naturally" (even though probably associated with initial attempt to access page without authentication, which seems to be a part of a standard communication protocol)