[FINAL] Validating hash when downloading/extracting bundles.

An attempt to validate bundle hashes as they come in the door.  I was able to sha1 hash the file contents as they stream in, avoiding secondary passes over the file contents.

This is a follow on attempt to #32
Checking for -1 follows the documentation of [InputStream.get()](http://docs.oracle.com/javase/7/docs/api/java/io/InputStream.html#read()).  I've seen this exact code in a number of different [libraries](http://commons.apache.org/proper/commons-io/apidocs/src-html/org/apache/commons/io/IOUtils.html#line.2132) before.  We could certainly use `> 0` instead, but I'd claim that is a little less common.