changed verify() to use staticCompare() for constant time string comparison, used hash_hmac()