oauth plaintext or sha1 signed headers