replacinb HMAC for security problem

Reported by @haruyama, Thx!
ref. http://twitter.com/haruyama/status/421481760057081856

implement with OpenSSL::HMAC
http://blog.nathanielbibler.com/post/63031273/openssl-hmac-vs-ruby-hmac-
benchmarks
> So, across 10,000 passes, OpenSSL’s HMAC implementation appears to be
roughly 20 times faster than the ruby-hmac gem for SHA1 hashing.