SHA1 sess.sec client side crypto derivate