and on top, looks like urlbox (properly) uses hmac!