Properly use HMAC for secure munging.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>

library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt

@@ -11,7 +11,7 @@ DEFAULT: NULL
     to check if a URI has passed through HTML Purifier with this line:
 </p>
 
-<pre>$checksum === sha1($secret_key . ':' . $url)</pre>
+<pre>$checksum === hash_hmac("sha256", $url, $secret_key)</pre>
 
 <p>
     If the output is TRUE, the redirector script should accept the URI.