The hashed credentials sent at login, and the session key that follows.
userHash: string
md5Modern(username + nonce).
passwordHash: string
md5Modern(password + nonce).
The first 16 characters of md5Modern(nonce + "-" + password), as UTF-8 bytes.