allow hash_vars in verify signature, thanks Anthony