security(tokens): adds HMAC API and improves security of friend invite token