auth_validate
which performs the validation (but you need to use 'validate_clients'
If you don't want your client to validate other ezQuake clients.
If you have 'auth_warninvalid 1' and someone gives a dirty hash in a version response (because they are using a hacked client that can't work out the right response), the client will print something like 'Warning Invalid Client: playername (userid)' in your console ('auth_warninvalid 0' is default).