wm_authenticate should be used directly in a WM callback
added proper test for roundtrip

GeneratedcCounterexamples indicate that hmac_api_lib:validate/4
crashes when non-unicode strings are passed to it.