HMAC/SHA1 implementation

Looking at the implementation of the signature method, I noticed it's not doing a proper HMAC, but instead, using a more simplistic SHA1(secret + data) which is known to be flawed and insecure.

This branch is a reimplemntation of the cookie signature scheme that uses the standard secure HMAC method.

It's functionally identical and is spec verified AFAIKT