HMAC authentication for server and client