Bug 799729 - Let HMAC extra parameter be the empty string.

This is against the spec (!), but seems natural to me.  It is assumed
by existing Mozilla Services server implementations, including the
token server.