hmax now works

would be nice to have test vectors but of course we don't since we just
made it up.  Would be the same with Comb4, so that's just what you get.
I'm pretty sure this isn't worse than HMAC alone...