Use proper HMAC-SHA1 for message authentication

* Test case to verify that the server secret indeed need to mach for
 tokens to be valid.
* Previously message authentication was done concatenating secret
 and payload feeding everything to SHA1, let's use HMAC-SHA1 as available
 in javax.security instead, heeding the advice of gkreitz.