So? If someone can steal the hash, they could probably hijack the session anyway.