Fixing up the HMAC validation to use the encryption key as the initialization for the HMAC. Removes the payload length part of the HMAC.
Now that the HMAC is calculated correctly, it is not necessary to skip the HMAC check for the spec data. However, the header on those tokens is PTK, not OTK, so the token check still has to be skipped.