[FINAL] Validating hash when downloading/extracting bundles.

An attempt to validate bundle hashes as they come in the door.  I was able to sha1 hash the file contents as they stream in, avoiding secondary passes over the file contents.

This is a follow on attempt to #32
I see `copyFile` on the same level as `unzipFile` and `streamToFile`, where we are doing the work of transferring bytes around.  Thus, we should ensure that the bytes written match the hash.

Plus it's cheap enough and we have the hash to verify, so we might as well do it.