Implement HMAC for signature tokens

This is a first attempt to fix FS#2794. It should be checked if there are other tokens that should use HMAC as well.