You're speaking in the theoretical sense, as you looked at the page source and noticed that the password is hashed with SHA1 locally before being compared against the database, right?
Even better. After they hash it they are sending the hash with the first 38 chars trimmed off and (presumably) getting a result set of only the hashes (or maybe one hash... not sure) that match the ending. Then comparing locally the full hash to the result set. I'd say that was a pretty smart way to do this.
Is the east-1 a way they know where I am?