Hashing done client side

Hashes are now computed client-side, server never sees a plain text
password.