Fixed client-side password SHA1