[FINAL] Validating hash when downloading/extracting bundles.

An attempt to validate bundle hashes as they come in the door.  I was able to sha1 hash the file contents as they stream in, avoiding secondary passes over the file contents.

This is a follow on attempt to #32
I agree that `< -1` is undefined and wouldn't make sense.  I would hope that would never be returned by the `read()` method.

My point isn't that other people do it, my point is that this is a standard specifically defined by the spec.

I'll change it.