don't require sha256: prefix for SHA256 hashes