Sigh. No hashes for you in browserland if your page is served from HTTP (self.crypto.subtle.digest is unavailable). Seriously? What an enormous pain in the ass.
Now I need to setup SSL certs to do development which means either fighting with browsers hating self-signed, or jumping through hoops to get a cert for a non-public host, or moving my development to a VPS machine, etc.
Update: I'm not asking how to do these things (I know how), just complaining about the necessity.