added proper test for roundtrip

Generated counterexamples indicate that hmac_api_lib:validate/4
crashes when non-unicode strings (char 55296 and above) are passed to it.

Ran 1,000,000 tests against hmac_api_lib:validate() without failures (minus non-unicode issue mentioned above). Reduced to 1000 for standard eunit tests.

- rebased on top of jc/webmachine-callback-api