title: Verify Facebook X-Hub-Signature
body: <p>On Cloud Code on Parse Im trying to verify the header <em>x-hub-signature</em> received from Facebook webhook. </p>
  
  <p><code>secret</code> is the right secret-key of the Facebook app.</p>
  
  <pre><code>var
  hmac,
  expectedSignature,
  payload = JSON.stringify(req.body),
  secret = 'xyzxyzxyz';
  
  hmac = crypto.createHmac('sha1', secret);
  hmac.update(payload, 'utf-8');
  expectedSignature = 'sha1=' + hmac.digest('hex');
  console.log(expectedSignature);
  console.log(req.headers['x-hub-signature']);
  </code></pre>
  
  <p>but the signatures never match.
  What is wrong?</p>