What's the difference between this plain "hash" you're sending and a plain "password", other than intentions?