Use Hmac instead of plain hashlib.sha256 to allow salt configuration.