handle non-ascii data
deprecated the "somethinghardtoguess" URL, some other cleanup

The URL is not supposed to be hard to guess, since the payload is signed.
Evil hackers can hit it as much as they want, if they don't know the SHA
secret.
nicer admin, verbose names, some pep8 cleanup
version bump