hmac the password before calling gridhash