application-key & signature now set in header