I'm not certain what jluxenberg is proposing with the hashes. But one possibility is that the exposed API will accept hashes that only the app can generate (through a salt). Although obviously you can crack the app, I suspect this is significantly harder.