fix #3320: OAuth signing is wrong