In V2 we shuffled the hash entries before sending the request to obscure the real entry from noises. We should also hide the real entry in V4. Using sort() is enough for both V2 and V4 because the array contains exactly 5 entries in almost all cases. MozReview-Commit-ID: 4uOXIF83KQL