Use hmac instead of just sha1