RFC: Specify that the signature contains the command for the message

Every message sent to the server is sent as a specific command therefore
the command string should be part of the signed content to prevent the
possibility of commands being maliciously send to the wrong endpoint and having
undesired concequences.

This is what we do in the Java implementation (though we might need to alter
the exact way we do that to comply with this spec).
protocol: alter the way we do signatures to make command a seprate field

Rather than command being part of the payload of the message - since it
is required fore very message sent make it a top level thing like the nonce
fields.

This makes us conform (more closely) to the current spec as just altered.