removed wrong filter for buy_post and token_hook. Removed unsafe code, i...

...mproved loading and checks #189
to avoid security leaks we already use hmac option - its a hash of entire url