now SHA256, not SHA1