HMAC-sha256, allow longer salt. Original patch provided by Colm
O'Flaherty but this is reworked for current tree.
Fix some debug output that went to stderr while other of same kind
goes to stdout.