hmac implemented on client & server side, but no verification yet