Moving to client-side hashing for online authentication [pdf]