support xauth with request token

Some websites, like 500px, require xauth requests to be signed with request token.