included HMAC spec in README.md