make cms_passhash cookie more secure... now relies on 2 variables from the user and 2 variables from the server.
minor improvement (no longer send the smtp server password in plain text in the settings page).