`Leonid' points out a stupid mistake in MD5 HMAC initialisation: we