Calculate SHA-1 Hash using the server secret, not the client secret

The docs: “This is the SHA-1 Hash calculated on the concatenation of uid, orderid, amount, description and shared secret. If the data is passed through the customers browser (POST parameters) you have to use the client secret, otherwise you have to use the server secret (POST XML).”