Calculate message HMAC on sorted query string.

I have reimplemented yubikey-val in Go (https://github.com/tgulacsi/yubikey-val/tree/go), and found some incompatibilities:

1. Hash of the response of the yubikey-val program is constructed into a query string, but for consistency, the arguments should be sorted before concatenation.
2. The values (esp. the date) may not be in a proper query string, must be escaped.

Example:
yubikey-val:
```
2014-10-01T12:59:53.31724 t=2014-10-01T14:59:53+0200 lvl=dbug msg=sign message="nonce=K6VsdKoaSebwFnf1Je6TGbKMn&otp=cccccccccccbvkikfhv
ghffnhfbbccjbngibrtkcclbk&sl=60&status=OK&t=2014-10-01T14%3A59%3A53%2B02%3A00" key="W?;`�H�s9c!Ě$p��("
2014-10-01T12:59:53.31751 t=2014-10-01T14:59:53+0200 lvl=info msg=Response ip=127.0.0.1:49249 version=2.0 otp=cccccccccccbvkikfhvghffnh
fbbccjbngibrtkcclbk body="h=K2NVWpFPspFofWezNGcnITamx/s=\r\nt=2014-10-01T14:59:53+02:00\r\nnonce=K6VsdKoaSebwFnf1Je6TGbKMn\r\nsl=60\r\notp=cccccccccccbvkikfhvghffnhfbbccjbngibrtkcclbk\r\nstatus=OK\r\n\r\n"
```

yubiauth:
```
[DEBUG] 2014-10-01 14:59:53 urllib3.connectionpool: "GET /wsapi/2.0/verify?id=2&otp=cccccccccccbvkikfhvghffnhfbbccjbngibrtkcclbk&nonce=
K6VsdKoaSebwFnf1Je6TGbKMn&h=3UK5hkB9WATwy1MRWDW6n2CzgnM= HTTP/1.1" 200 164
[DEBUG] 2014-10-01 14:59:53 yubico.client: Received response from http://127.0.0.1:12345/wsapi/2.0/verify?id=2&otp=cccccccccccbvkikfhvg
hffnhfbbccjbngibrtkcclbk&nonce=K6VsdKoaSebwFnf1Je6TGbKMn&h=3UK5hkB9WATwy1MRWDW6n2CzgnM= (thread=Thread-2): h=K2NVWpFPspFofWezNGcnITamx/
s=
t=2014-10-01T14:59:53+02:00
nonce=K6VsdKoaSebwFnf1Je6TGbKMn
sl=60
otp=cccccccccccbvkikfhvghffnhfbbccjbngibrtkcclbk
status=OK


[WARNING] 2014-10-01 14:59:53 yubico.client: key='W?;`\xccH\x11\x10\xd7s9c!\xc4\x9a$p\x95\x80(' parameters=u'nonce=K6VsdKoaSebwFnf1Je6T
GbKMn&otp=cccccccccccbvkikfhvghffnhfbbccjbngibrtkcclbk&sl=60&status=OK&t=2014-10-01T14:59:53+02:00' generated=u'm43fdVeLbWzHVCYuWa6mzH8
OXZs=' got=u'K2NVWpFPspFofWezNGcnITamx/s='
```


After this change:
```
2014-10-01T13:54:31.23497 t=2014-10-01T15:54:31+0200 lvl=dbug msg=sign message="nonce=JewhaxeIx46pjh2XDNWiLz1Bl&otp=cccccccccccbjjjgtfdtlelfkhtnnbueiurilluvjnkc&sl=60&status=OK&t=2014-10-01T15%3A54%3A31%2B02%3A00" key="W?;`�H�s9c!Ě$p��("
2014-10-01T13:54:31.23497 t=2014-10-01T15:54:31+0200 lvl=info msg=Response ip=127.0.0.1:49267 version=2.0 otp=cccccccccccbjjjgtfdtlelfkhtnnbueiurilluvjnkc body="h=zy8A99+thYQUPRO5n2QB15R70Y8=\r\nt=2014-10-01T15:54:31+02:00\r\nsl=60\r\notp=cccccccccccbjjjgtfdtlelfkhtnnbueiurilluvjnkc\r\nnonce=JewhaxeIx46pjh2XDNWiLz1Bl\r\nstatus=OK\r\n\r\n"
```

```
[DEBUG] 2014-10-01 15:54:31 urllib3.connectionpool: "GET /wsapi/2.0/verify?id=2&otp=cccccccccccbjjjgtfdtlelfkhtnnbueiurilluvjnkc&nonce=JewhaxeIx46pjh2XDNWiLz1Bl&h=X7W8UI4phSkZ6HXfZ2Pa/nFYIaA= HTTP/1.1" 200 164
[DEBUG] 2014-10-01 15:54:31 yubico.client: Received response from http://127.0.0.1:12345/wsapi/2.0/verify?id=2&otp=cccccccccccbjjjgtfdtlelfkhtnnbueiurilluvjnkc&nonce=JewhaxeIx46pjh2XDNWiLz1Bl&h=X7W8UI4phSkZ6HXfZ2Pa/nFYIaA= (thread=Thread-1): h=zy8A99+thYQUPRO5n2QB15R70Y8=
t=2014-10-01T15:54:31+02:00
sl=60
otp=cccccccccccbjjjgtfdtlelfkhtnnbueiurilluvjnkc
nonce=JewhaxeIx46pjh2XDNWiLz1Bl
status=OK


[INFO] 2014-10-01 15:54:31 yubiauth.util.utils: validate_otp(u'cccccccccccbjjjgtfdtlelfkhtnnbueiurilluvjnkc'): True
[INFO] 2014-10-01 15:54:31 yubiauth.client.controller: Authentication successful. Username: None, password: <valid password>, OTP: cccccccccccbjjjgtfdtlelfkhtnnbueiurilluvjnkc
```