Insecure authentication

[Jonas-Hamburg]

The password should already be provided in hashed form on the server side and should not be sent back to the client. Currently, the plaintext password is stored on the server and client instead of being protected by time-limited tokens.

[miantiao-me]

It's been optimized.