look for HTTP_HMAC_AUTH header, not HMAC_AUTH header