Raise explicit error when `hmac_secret` is not set but is required

[janko]

Some features such as webauthn and active sessions require hmac_secret to be set, but raise a cryptic error when it's missing:

TypeError: no implicit conversion of nil into String

Since it's not clear from this error that the issue is in hmac_secret not being set, we change this to raise an explicit ArgumentError (like the JWT feature does for jwt_secret).

[jeremyevans]

Thanks for the patch. I agree this is a good way to fix the issue.