HMAC token verification in Go, compatible with ActiveSupport::MessageVerifier