Use HMAC auth rather than HTTP Basic
Merge branch 'hmac-signed-auth'