correct oauth signing mechanism