HMAC authentication of requests