Prevent hash length extension attack

refs Redmine R4701
refs Github #348
see http://blog.whitehatsec.com/hash-length-extension-attacks/

Thanks @birkir