swim payloads are insecure

[nomilous]

If at any point we want to run a private cluster spanning a public network any 3rd party with a capacity to view network traffic between cluster members can learn the swim update dissemination payload structure, craft their own payload and send it to an existing member - at which point that member will disseminate the 3rd party's inclusion in the cluster to all members, each of which will then log into the 3rd party's happn server with the cluster's password. Thus exposing the password.