added appsecret_proof functionality, tested hash_hmac, need to test against fv