Cryptography should only be used when there is no other option (SSL/TLS is a good example where cryptography is required).  An HMAC always introduces the possibility of the trivial attack (brute force).  Further more, an HMAC can also be a waste of computation effort, when compared to other solutions such as a simple Cryptographic Nonce used to reference the data.

PBKDF2 is used to stretch low entropy input,  such as human generated passwords,  to be used as cryptographic keys.  In order for PBKDF2 to be useful it will consume significant computational effort to produce the resulting hash.  An application exposing this kind of functionality is vulnerable to an Algorithmic Complexity Attack (ACA), and this would be a very serious vulnerability if this was finical software,  because DoS attacks result monetary damages.

PBKDF2 is a useful, especially for passwords, however by exposing this function to an attacker without any form of rate-limiting, creates a potential DoS condition.  SHA256 is just fine for use as an HMAC,  in fact SHA1 would be a better choice for a web application because its faster and the prefixing attacks against SHA1 do not weaken the resulting HMAC. The secret key is what is important,  and you still have to worry about offline brute-force attacks.   But that can be addressed by making the secret key 128 bytes long, which solves that problem for the life our solar system (with some comfort room!).