Adds AuthorizationHeader (with build() to construct the a new object with the field value).
Normalises to using "key" (from "secret").
Matches Node/Ruby implementation with payload: hash is calculated if key is present, even if value is null. I'm not sure how valid this is, but I need to maintain compatibility.
Moves $credentials normalisation into Credentials itself.
TODO. (Dump of progress for rebasing later.)