RFC 6238 isn't clear enough in the Test Vectors section, and the different HMAC algorithms use different secrets.
Add all the test vectors from RFC 6238, but comment the non-SHA1 ones for the time being.