add signature checking in post message handling