somewhat secure hmac generation checking
exress -> 4.0, one time access key generation and check complete