Cleaning code.
signedDecodeAndParse() now check if APP is registered before grant access.
GET /pdf and POST /pdf now merges default and incoming params in a more elegant way.
fix some @todo