Signed urls

I don't expect this to be accepted yet.

* I haven't tested yet. Perhaps you can tell me the easiest way to get that set up.
* Not sure if this is the easiest way to pass around a secret.
* Not sure about absolute import weirdness.
* Not sure if you want this / if I completely missed the point.
* Not sure if sha-256 hits the secure/reasonable sweet spot.
* etc.

At least this should get the conversation going. Let me know what you think.