this should be a HMAC, not just a hash