Improve Auth Header Parsing

Related: #105

Use the URL safe version of base64 decoding. Don't break
when comparing secret keys to advert possible timing attacks.
Add tests for auth parsing.