fixed HMAC calculation. Tested and verified