work with sha.js@3.0.0
merge
simpler hmac - that doesn't do anything weird to objects
pbkdf2
tidy
update readme
more createHmac coverage
use buffers in rng
do this once, instead of many times