Add HMAC-SHA256 support.

There may be a better way to do this, but I implemented the server side first ([reference implementation](https://github.com/rknLA/geo.rkn.la/blob/master/index.js)), and computed the base64 HMAC-SHA256 on a serialized copy of the locations array.

A bunch of the code is copy-paste from stack overflow, but I've verified that the server returns an appropriate error for mismatched keys.