login use challenge response authentication instead of sha1 comparison