PayboxSystem: move query_to_param and hmac to private