use crypto object

this is kind of experimental but in theory should work, it uses the built in crypto.subtle object when it is async, the browser supports it, and it's just using sha1 (which is all that it seems to handle), we probably need to add some browser tests if we wanted to merge something like this.
its also just how poorly speced and inconsistently implemented the api is, this will work in firefox dev, but I'm not sure about chrome.