Length-extension attacks are still a thing