--hash-password changed to incorporate the return value of WEB_RequestSessionID. If you are using --insecure flag and cannot login, try using this flag.