URLSafeSerializer("") accepted — empty string creates HMAC-less tokens

Description

itsdangerous accepts an empty string as the secret key for `URLSafeSerializer`. The resulting HMAC is cryptographically trivial — any party knowing the serializer format can forge tokens. No error or warning is raised.

Reproduction

from itsdangerous import URLSafeSerializer
s = URLSafeSerializer('')
token = s.dumps({'user': 'admin'})
result = s.loads(token)
# Returns: {'user': 'admin'} — no error