HMAC uses md5 by default

[gimli5009]

the HMAC module in Crypto.Hash.HMAC uses the md5 hash by default, md5 is a largely outdated hash with many known security vulnerabilities (see http://en.wikipedia.org/wiki/MD5#Vulnerability). I suggest changing the default to SHA-2 or not having one and instead having a user passing in a hash function that they believe to be secure.

[Darsey Litzenberger (dlitz)]

We can't change the default to SHA-2 without silently breaking people's code. The best we can do is to emit a warning when the default is relied upon, and eventually force the user to explicitly specify the hash function.