token based user authentication utility via hmac with shared secret
sketching out a little with identity service