hmac instead md5

hash_str(s) now use hmac