update varhash

the feature set is the same, but there are more tests and it's pure js, again.