implement HMAC signatures (fixes #3); default should be changed to sha256 once ipython/ipython#3756 lands