replace deprecated mhash() with hash_mac()