#hex-decode clear

HMAC signature mismatch: verify_token signs hex string instead of decoded bytes