Change the authentication API from sending away the hash to doing the compare server side