using hmac instead of hashlib because it is more secure