#4 SCRAM-SHA-1: check clientProof in server