Use SHA-256 instead of SHA-1 by default

Potentially overkill. 

Now that SHA-1 has a confirmed collision in the wild ([thanks, Google](https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html)), for security/compliance purposes the default hash algorithm should be upgraded to SHA-256.