hashing on client, checking hmac on server