overhaul of API authentication: using HMAC now