#signature-verification clear

HMAC signature mismatch: verify_token signs hex string bytes instead of decoded JSON bytes