Use proper HMAC-SHA1 for message authentication

* Test case to verify that the server secret indeed need to mach for
  tokens to be valid.
* Previously message authentication was done concatenating secret
  and payload feeding everything to SHA1, let's use HMAC-SHA1 as available
  in javax.security instead, heeding the advice of gkreitz.
Merge pull request #12 from noaresare/pr/hmac-rebased

Use proper HMAC-SHA1 for message authentication