note about sha256 and HMAC