Fixes several security vulnerabilities

Most important changes:
- Replaces SHA1(key | message), which is not a secure MAC, with HMAC.
- Removes useless nonce. To actually provide some defense against
  e.g. replay attacks, the django side should provide freshness, or the
  webauth side should provide a timestamp. In fact, the nonce is worse than
  useless, because it (along with the careless way in which it's used)
  enables several other attacks.
- Ignores next URL to prevent CSRF attacks