add repository field to package.json
add support for HMAC to prevent length extension attacks, resolves #1