code: func DeriveLoginHMAC(ctx context.Context, password []byte, salt, token string) (string, error) {
  	key, err := derivePassword(ctx, password, salt)
  	if err != nil {
  		return "", err
  	}
  
  	pwh := make([]byte, base64.RawURLEncoding.EncodedLen(32))
  	base64.RawURLEncoding.Encode(pwh, key)
  
  	mac := hmac.New(sha512.New, pwh)
  	mac.Write([]byte(token))
  	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil)), nil
  }
docs: // DeriveLoginHMAC HMACs the provided token with a key derived from password
  // and the provided base64 encoded salt.