timeout alerts. switched to sha1 for passwords