verify/parseHash should accept object

[ericelliott]

verify/parseHash should accept object

[ericelliott]

There's no need for the user to store the hash as an object. It works great as-is storing it as a string (simple key-value pair in any datastore), unless you see a potential attack in the way we handle JSON?

[tjconcept]

There could be minor advantages like querying for passwords with too few iterations and similar, but it is not worth the breaking change when the work-around is so simple (JSON.parse/stringify on the user-side). Also it would make it less simple, which is not desirable for this API.

I have considered this myself earlier and is just leaving my notes/findings here for future-Thomas to revisit when I forget;

• verify could accept an object in a backwards compatible fashion
• hash can not easily return an object (maybe using a prototype with toString method - but too risky and hack-ish)
• support for this would require a new/redundant "hash" method returning an object