implemented /sign with hawk credentials

uses the signToken to derive the hawk tokenId and reqHMACkey as specified:
https://wiki.mozilla.org/Identity/AttachedServices/KeyServerProtocol#Signing_Certificates