HSxxx with shared key directly
nonce() use base64url_encode