decoupling OAuth 1.0/a signing logic from session layer