changed cookie hmac verification to use go1.1 hmac.Equal func