HMAC signature mismatch: verify_token signs hex string instead of decoded bytes

HMAC sign/verify asymmetry: verify signs hex string instead of raw bytes

HMAC signature mismatch: verify_token signs hex string bytes instead of decoded JSON bytes