stop requiring md5: it is in DIGEST now
refactor, make it clear we only support MD5 for now