clean up loader and make docs default to hmac sha256