only authenticating functions return clientHash, bigger check