uses HMAC instead of plain SHA-1