Add a (failing) test for tampered HMACs

The test input conveniently chosen so that the HMAC (mis-)interpreted as UTF-8
gives REPLACEMENT CHARACTER (U+FFFD) at the end.
Check HMACs better

Makes the previous test pass. The previous version incorrectly treated the HMAC
as a UTF-8 which loses bits to replacement characters. Also, make some attempt
to check it in constant-time. Ideally node would provide a native
implementation less sensitive to the JS implementation.
Fix node 0.8 HMAC code

In 0.8, crypto returns binary-encoded strings for a lot of operations. This
normalizes everything to Buffers and fixes some type confusion. Previously,
node 0.8 encoded HMACs as
  base64(encodeUTF8(pretendEachByteIsUnicodeCodePoint(hmac)))
and checked them correctly, while node 0.10 encoded HMACs as
  base64(hmac)
but checked them incorrectly.
Merge pull request #48 from davidben/master

Fix UTF-8 confusion in HMAC check