fix hmac handling