the website does not send your password to their api but the first 5 chars of an sha1 of your password