testing HMAC secret