Client/server communication now uses HMAC for auth

This is to prevent a convoluted exploit that can trigger remote code execution.
Error handler now also sets HMAC header.