Per review w/@ygluck, during verification, check timestamp prior to
HMAC to minimize timing attack potential.  Also be more specific about
padding algorithm.