Rewrote plugin

- Use HMAC authentication
- Use newer object-oriented gateway api
- More entropy for callback secret

Fixes #1 and #2