hmac_sha1_hex() returns a 41 (not 40) character value