fix for (null) at the end of the signing key

Here is a fix for scenarios in which there is no auth token secret. For instance in step 1 of reverse auth. Prior to this fix the signing key had '(null)' appended to the end and the signature was invalid every time.

All this fix does is use the empty string for the auth token secret when one exists, instead of using '(null)'.

Thanks!
Andrew