add bpHash() function which generates a URL-safe base64-encoded HMAC.