wp_hash() no longer needed. Using Duo::verifyResponse which uses sha1 hash_hmac