properly escape token when signing zd remote auth