Use proper HMAC-SHA1 for message authentication

Rebase of https://github.com/spotify/crtauth-java/pull/9

* Test case to verify that the server secret indeed need to mach for
  tokens to be valid.
* Previously message authentication was done concatenating secret
  and payload feeding everything to SHA1, let's use HMAC-SHA1 as available
  in javax.security instead, heeding the advice of gkreitz.