Fix: Don't authenticate with payload unless header includes hash