remove header comments
centralize the signature verification method
rename credentials params