changes from crypto review

Per review w/@ygluck, during verification, check timestamp prior to HMAC to minimize timing attack potential.  Also be more specific about padding algorithm.