use hmac for external ressource hash FS#2794
use HMAC for CSRF security tokens FS#2794
use HMAC in password reset token FS#2794