With reference to the construction of HMAC, explain how changing the design of the API in Part 1.2 to use token = HMAC_user's password(user=...) would avoid the length extension vulnerability. With reference to the construction of HMAC, explain how changing the design of the API in Part 1.2 to use token = HMAC_user's password(user=...) would avoid the length extension vulnerability