I updated to v2, dunno if it did make the PR or not. And @Justin, the HMAC isn't added exactly for security, more to have a fast (faster than checking on the database) way to treat requests that don't have a valid token (since the token is valid or not by itself and we don't have to check it anywhere unless it is).