sha1 considered weak
User-Agent is not a required header.
avoid side channel attack on string comparison
avoid xss