sha1 crypto and one-time token verification for login