(fix) Use HMAC for signatures

Using a plain SHA-256 hash for message authentication is vulnerable to
length extension attacks. Use the secure HMAC construct from rust-crypto.
Merge pull request #21 from veeti/hmac

(fix) Use HMAC for signatures