use hmac Hashing instead of md5