Would love you input whether I left any security holes.<p>Username/password are never passed back and forth, only the unique hash.<p>Hash is removed from the database once it’s used, old hashes that haven’t been used can’t be unless the database is hacked, but then you have bigger issues.<p>All database queries of the hash have been escaped to prevent XSS attacks.