Fix the validation of signed requests.

Fix the signed request validation and provide a unit test which ensures it works. It could be solved better since it now decodes the payload twice, but I didn't want to break the existing public API.