Even with HMAC you have to be careful! A contrived example:

    HMAC(secret, username || email)

Imagine you have `bob` and `bob@example.com` as inputs. This HMAC can trivially be reused (or learned) by registering `bobb` and `ob@example.com`.

If you ever have multiple fields being concatenated, use fixed-width length prefixes before each field:

   HMAC(secret, 0x0003 || bytes("bob") || 0x000e || bytes("bob@example.com"))