make the HttpException an Exception rather than a RuntimeException so it must be caught
handle the thrown exception when signing fails