Sign cookie session id with hmac-sha256