note 26022 added to function.md5

This is to everyone who said "just store the md5 hash of the users password on the server, then get the user to send the the hash of their password to log in."

This technique is just as bad as sending a clear text password, if an attacker was to intercept the user sending the hash of their password, then all they would need to do is submit the same hash to gain access.

Always use some kind of random variable.