Use HMAC instead of plain SHA1

You should never do message authentication using plain hashing methods but use HMACs instead [(1)](http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed-hashes-use-hmac/).

Please note that I wrote this changeset on a PC that doesn't have PHP; so please check if the code runs at all before merging. :-)