hash sha1 instead of base64 to hide generation specifics