Server-side md5 check