add verification that hash matches plugin content on server side