Only validate HMAC if debug mode is off
Change the way HMAC signatures are compared