Comment by turminal

That would imply WAF gets to see unhashed passwords, so not good at all.