use crypto object

this is kind of experimental but in theory should work, it uses the built in crypto.subtle object when it is async, the browser supports it, and it's just using sha1 (which is all that it seems to handle), we probably need to add some browser tests if we wanted to merge something like this.