Use HMAC instead of concatenating secrets

- Switch to a more secure secret scheme
- Test updated