note about sha-1 hmac