decode the signed_request before processing