hmac_sha1_hex() returns a 41 (not 40) character value

matching on 40 characters still works, but 41 is more correct.