check site hash at login