Yeah, I'm +1 for either doing it in bolus.js or not doing it at all.  I'm personally fine with either, fwiw.  So, take your pick unless @kentquirk feels strongly about hashing?