Given this, maybe it makes sense to pass the Request object through.  With the Request object you could chain up through the redirects to get to the original request and sign based on that.

Seems like Photobucket might be unique in this, so maybe they hack isn't too bad...

https://groups.google.com/d/topic/oauth-extensions/kqIXs3tDXUw/discussion
http://www.mail-archive.com/oauth@googlegroups.com/msg00021.html